Exercise 1: Encrypting db_vars.yml In Place — Possible Solution
====================================================================

ansible-vault encrypt db_vars.yml

Explanation:

This uses the chapter's own encrypt subcommand exactly as described --
"encrypt an existing plaintext file in place" -- pointed at the
specific filename given in the exercise. Unlike create, which makes a
brand-new encrypted file from scratch, encrypt takes a file that
already exists in plaintext and converts it to encrypted form directly,
overwriting the original plaintext content on disk with the encrypted
version.

-- What the file looks like immediately afterward --
--
-- Following the chapter's own description of an encrypted file's
-- appearance, db_vars.yml would now start with the line
-- $ANSIBLE_VAULT;1.1;AES256, followed by many lines of base64-style
-- ciphertext with no readable structure, variable names, or values
-- visible anywhere in the file -- genuinely unreadable without the
-- vault password, and safe to commit to version control from this
-- point on. None of the original plaintext YAML (variable names or
-- their values) remains visible in the file at all; the entire
-- content, not just the sensitive values, is now opaque ciphertext.

WHY THIS WORKS AS AN ANSWER
------------------------------
This uses the correct chapter-specified subcommand for encrypting an
existing file (rather than create, which is for new files), and
describes the resulting file's actual on-disk appearance using the
chapter's own stated format.